Data Processing

Crosstabs is built around a local-first analysis flow. This page documents what is processed locally and what can leave the browser.

Local workflow

Uploaded files are parsed in the browser into rows and variable metadata.
Crosstab computation, filters, weighting, recodes, statistics, charts, and exports are produced from browser state.
Saved projects use versioned browser IndexedDB when available, with localStorage as a compatibility fallback. Saved analysis templates use localStorage on the same device and browser profile.
A saved project includes the parsed source rows and current analysis settings so it can be reopened after a reload. It is not uploaded or synchronized to another device.
New saved-project navigation keeps the local project identifier after #, which browsers omit from HTTP requests. A legacy ?project= link is consumed and removed from the address and history entry in the browser after its initial page request.
A full portable .ctproj package contains that complete project and its rows. A definition-only manifest omits rows, filenames, category values, open-end response evidence, and repair inverse snapshots; neither package type is encrypted.
There is no server or hybrid fallback for an oversized workload. Crosstabs blocks the run and asks you to reduce the table or split the file instead of uploading respondent data.

When a user creates a result link, Crosstabs encodes aggregate counts, row and column labels, and the context the user selected into the URL fragment after #.
The source file and respondent-level rows remain in the creator's browser; they are not placed in the link or uploaded by the share-link workflow.
A recipient's browser decodes the fragment locally. The HTTP request fetches the generic Crosstabs page without the fragment, and browsers omit fragments from HTTP referrer headers.
Crosstabs does not retain the fragment on a server. Anyone with the complete link can read the included aggregates and context, and the link has no account permissions, expiration, or revocation control.

Crosstabs does not provide hosted AI analysis, project planning, or open-end generation, and it does not send project prompts or respondent data to a model provider.
The separate local MCP package lets an AI or local agent work with files and projects inside a user-run process on that device.
The public API and MCP accept only explicitly supplied aggregate matrices or public evidence queries. They perform bounded deterministic work without creating a hosted project or model conversation.
Browser findings and method disclosures are generated from the completed local table and remain reviewable without a hosted model call.

Production Web Analytics receives redacted page paths, referring origins, and coarse product-event occurrences. Speed Insights receives the same redacted path plus Web Vitals. Query strings and URL fragments are removed before either client sends them, /s aggregate snapshot routes are excluded, and a no-referrer policy prevents the current page URL from being forwarded when a link is followed.
A sessionStorage activation record contains only a coarse surface, upload/sample/manual input, started/ready/completed stage, acquisition-provider category, and landing-cluster category. It stays in the current tab, contains no account, user, session, or random attempt identifier, and is not synchronized between tabs or devices.
Activation properties never include filenames, project identifiers, spreadsheet cells or rows, variable and category labels, filter values, AI text, or aggregate share fragments.
Each activation stage is an independent aggregate occurrence. Occurrence ratios can indicate direction within one reporting window, but they are not conversion rates and cannot be joined into a user, session, or attempt journey.
Vercel processes analytics and performance data under its current privacy and retention terms. Crosstabs does not copy these events into an application database.

PDF and XLSX reports include audit metadata such as source file name, filters, weight variable, missing-value setting, report title, analyst, and generated timestamp.
CSV exports sanitize spreadsheet formula prefixes to reduce spreadsheet-injection risk.
Portable-project import buffers the JSON locally, verifies SHA-256 checksums and schema versions, previews migration, and creates a new project id. Verification failure does not mutate browser storage.
Crosstabs does not currently provide account-level retention controls because the public app has no account system. Aggregate share links are not server-stored and cannot be expired or revoked.
Local projects can be removed from the home page or workspace. Clearing Crosstabs site data in the browser removes local projects and templates.